maintainability-agent 4.4.4__tar.gz → 4.4.6__tar.gz

{maintainability_agent-4.4.4/src/maintainability_agent.egg-info → maintainability_agent-4.4.6}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.4.4
+Version: 4.4.6
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.4.4**.
+Version **4.4.6**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -90,10 +90,12 @@ npm install -g jscpd eslint            # duplication + JavaScript/TypeScript
 brew install pmd checkstyle spotbugs   # JVM languages, optional
 ```
 
-Unpinned on purpose: this is the exact set CI installs and calibrates against,
-and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
-disagree. Nothing here is required — the audit runs without any of it and tells
-you what it could not measure.
+This is the exact set CI installs, and
+`test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
+disagree. CI installs it at the versions in `constraints/analyzers.txt`, the
+ones the scale was calibrated with; add `-c constraints/analyzers.txt` from a
+source checkout to match them. Nothing here is required — the audit runs
+without any of it and tells you what it could not measure.
 
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
@@ -204,6 +206,7 @@ The full argument, including what this deliberately does not compete on:
 ```bash
 python3 -m pip install maintainability-agent
 maintainability-agent --root . --config maintainability-agent.json
+maintainability-agent --update    # later: upgrade, re-sync the skill, restart stale MCP servers
 ```
 
 Or run from a source checkout without installing:
@@ -267,6 +270,21 @@ withheld estimate. For PR work, add `--changed-only main...HEAD` to audit the
 diff; on a change too small to support a rate, the estimate and grade are
 withheld and the scope is named as the reason.
 
+**Hold the code a change touches to a stricter bar.** `policy.changed_code` in
+`maintainability-agent.json` sets tighter function limits for what a change
+adds or alters, so a team can gate new work without first fixing every old
+function:
+
+```json
+"policy": {"changed_code": {"max_function_lines": 40, "max_complexity": 10}}
+```
+
+On a `--changed-only` run, a function the change touched is held to it and
+untouched code is judged by the standard as before. A policy only tightens — a
+looser limit is refused when the config loads — and it decides the gate, never
+the grade: breaches fail `--fail-on-gate` and are listed under *Changed-code
+policy*, and the score is unchanged.
+
 ### Checking that the agent did the work
 
 The work order tells an agent to fix exactly these findings and refactor nothing
@@ -503,8 +521,9 @@ maintainability-agent --install-skill        # writes ~/.claude/skills
 ```
 
 `maintainability-agent --update` upgrades the install to the newest release —
-never a downgrade — re-syncs the skill, and says when the MCP server needs a
-restart; `maintainability-agent --install-updater` runs it hourly (macOS launch
+never a downgrade — re-syncs the skill, and stops any MCP server still on an
+older version that is not mid-audit, so the host starts the new one on its
+next call; `maintainability-agent --install-updater` runs it hourly (macOS launch
 agent). Run `--install-skill` by hand after any other upgrade — a drifted skill
 teaches agents a dead workflow,
 so a differing installed copy is refused with the list of differences. Per-host
@@ -517,7 +536,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.4.4
+- uses: marshallguillory86/maintainability-agent@v4.4.6
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/README.md

@@ -5,7 +5,7 @@
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.4.4**.
+Version **4.4.6**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -48,10 +48,12 @@ npm install -g jscpd eslint            # duplication + JavaScript/TypeScript
 brew install pmd checkstyle spotbugs   # JVM languages, optional
 ```
 
-Unpinned on purpose: this is the exact set CI installs and calibrates against,
-and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
-disagree. Nothing here is required — the audit runs without any of it and tells
-you what it could not measure.
+This is the exact set CI installs, and
+`test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
+disagree. CI installs it at the versions in `constraints/analyzers.txt`, the
+ones the scale was calibrated with; add `-c constraints/analyzers.txt` from a
+source checkout to match them. Nothing here is required — the audit runs
+without any of it and tells you what it could not measure.
 
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
@@ -162,6 +164,7 @@ The full argument, including what this deliberately does not compete on:
 ```bash
 python3 -m pip install maintainability-agent
 maintainability-agent --root . --config maintainability-agent.json
+maintainability-agent --update    # later: upgrade, re-sync the skill, restart stale MCP servers
 ```
 
 Or run from a source checkout without installing:
@@ -225,6 +228,21 @@ withheld estimate. For PR work, add `--changed-only main...HEAD` to audit the
 diff; on a change too small to support a rate, the estimate and grade are
 withheld and the scope is named as the reason.
 
+**Hold the code a change touches to a stricter bar.** `policy.changed_code` in
+`maintainability-agent.json` sets tighter function limits for what a change
+adds or alters, so a team can gate new work without first fixing every old
+function:
+
+```json
+"policy": {"changed_code": {"max_function_lines": 40, "max_complexity": 10}}
+```
+
+On a `--changed-only` run, a function the change touched is held to it and
+untouched code is judged by the standard as before. A policy only tightens — a
+looser limit is refused when the config loads — and it decides the gate, never
+the grade: breaches fail `--fail-on-gate` and are listed under *Changed-code
+policy*, and the score is unchanged.
+
 ### Checking that the agent did the work
 
 The work order tells an agent to fix exactly these findings and refactor nothing
@@ -461,8 +479,9 @@ maintainability-agent --install-skill        # writes ~/.claude/skills
 ```
 
 `maintainability-agent --update` upgrades the install to the newest release —
-never a downgrade — re-syncs the skill, and says when the MCP server needs a
-restart; `maintainability-agent --install-updater` runs it hourly (macOS launch
+never a downgrade — re-syncs the skill, and stops any MCP server still on an
+older version that is not mid-audit, so the host starts the new one on its
+next call; `maintainability-agent --install-updater` runs it hourly (macOS launch
 agent). Run `--install-skill` by hand after any other upgrade — a drifted skill
 teaches agents a dead workflow,
 so a differing installed copy is refused with the list of differences. Per-host
@@ -475,7 +494,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.4.4
+- uses: marshallguillory86/maintainability-agent@v4.4.6
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6/src/maintainability_agent.egg-info}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: maintainability-agent
-Version: 4.4.4
+Version: 4.4.6
 Summary: Maintainability gate and AI remediation prompt generator for CI.
 Author: Marshall Guillory
 License: MIT
@@ -47,7 +47,7 @@ Dynamic: license-file
 **A deterministic, offline maintainability audit whose output is a _bounded
 work order_ for an AI coding agent** — a copy-paste prompt, per finding, that
 says *fix exactly these and refactor nothing else*. Chat-primary; CLI for CI.
-Version **4.4.4**.
+Version **4.4.6**.
 
 > ## **Calibrated against 201 mature open-source repositories in fifteen languages.**
 >
@@ -90,10 +90,12 @@ npm install -g jscpd eslint            # duplication + JavaScript/TypeScript
 brew install pmd checkstyle spotbugs   # JVM languages, optional
 ```
 
-Unpinned on purpose: this is the exact set CI installs and calibrates against,
-and `test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
-disagree. Nothing here is required — the audit runs without any of it and tells
-you what it could not measure.
+This is the exact set CI installs, and
+`test_the_readme_names_the_analyzer_pool_ci_installs` fails if the two ever
+disagree. CI installs it at the versions in `constraints/analyzers.txt`, the
+ones the scale was calibrated with; add `-c constraints/analyzers.txt` from a
+source checkout to match them. Nothing here is required — the audit runs
+without any of it and tells you what it could not measure.
 
 **Install secure-code-agent for the security pillar.** Every audit runs it; it is
 installed alongside rather than as a dependency, so the two tools release
@@ -204,6 +206,7 @@ The full argument, including what this deliberately does not compete on:
 ```bash
 python3 -m pip install maintainability-agent
 maintainability-agent --root . --config maintainability-agent.json
+maintainability-agent --update    # later: upgrade, re-sync the skill, restart stale MCP servers
 ```
 
 Or run from a source checkout without installing:
@@ -267,6 +270,21 @@ withheld estimate. For PR work, add `--changed-only main...HEAD` to audit the
 diff; on a change too small to support a rate, the estimate and grade are
 withheld and the scope is named as the reason.
 
+**Hold the code a change touches to a stricter bar.** `policy.changed_code` in
+`maintainability-agent.json` sets tighter function limits for what a change
+adds or alters, so a team can gate new work without first fixing every old
+function:
+
+```json
+"policy": {"changed_code": {"max_function_lines": 40, "max_complexity": 10}}
+```
+
+On a `--changed-only` run, a function the change touched is held to it and
+untouched code is judged by the standard as before. A policy only tightens — a
+looser limit is refused when the config loads — and it decides the gate, never
+the grade: breaches fail `--fail-on-gate` and are listed under *Changed-code
+policy*, and the score is unchanged.
+
 ### Checking that the agent did the work
 
 The work order tells an agent to fix exactly these findings and refactor nothing
@@ -503,8 +521,9 @@ maintainability-agent --install-skill        # writes ~/.claude/skills
 ```
 
 `maintainability-agent --update` upgrades the install to the newest release —
-never a downgrade — re-syncs the skill, and says when the MCP server needs a
-restart; `maintainability-agent --install-updater` runs it hourly (macOS launch
+never a downgrade — re-syncs the skill, and stops any MCP server still on an
+older version that is not mid-audit, so the host starts the new one on its
+next call; `maintainability-agent --install-updater` runs it hourly (macOS launch
 agent). Run `--install-skill` by hand after any other upgrade — a drifted skill
 teaches agents a dead workflow,
 so a differing installed copy is refused with the list of differences. Per-host
@@ -517,7 +536,7 @@ instead of an invokable skill:
 This repo ships `action.yml`, usable as a composite action:
 
 ```yaml
-- uses: marshallguillory86/maintainability-agent@v4.4.4
+- uses: marshallguillory86/maintainability-agent@v4.4.6
   with:
     config: maintainability-agent.json
     changed-only: main...HEAD

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_agent.egg-info/SOURCES.txt

@@ -185,6 +185,7 @@ tests/test_analyzer_scoring_path.py
 tests/test_analyzer_spread_range.py
 tests/test_analyzer_xml_bounds.py
 tests/test_analyzers_against_the_real_tools.py
+tests/test_analyzers_leave_no_temp_dirs.py
 tests/test_analyzers_never_write.py
 tests/test_analyzers_report_what_actually_failed.py
 tests/test_anchor_and_mode.py
@@ -206,6 +207,7 @@ tests/test_band_concealment_class.py
 tests/test_band_concealment_p3.py
 tests/test_band_pressures.py
 tests/test_bands.py
+tests/test_base_ref_only_where_it_exists.py
 tests/test_behaviour_suites_are_tests.py
 tests/test_body_or_signature_class.py
 tests/test_both_setup_paths_ask_the_same_stage.py

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/__init__.py

@@ -1,3 +1,3 @@
 """Maintainability Audit CI."""
 
-__version__ = "4.4.4"
+__version__ = "4.4.6"

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/_adapters.py

@@ -236,6 +236,29 @@ class BaseAdapter:
     # Empty means "trust the catalog entry".
     languages: tuple[str, ...] = ()
 
+    def scratch(self) -> Path:
+        """This run's scratch directory, made on first use (D235).
+
+        Four adapters made one with `mkdtemp` in their constructors and
+        never removed it, so every adapter object left a directory whether
+        or not its tool ran: 74,535 of them on one machine. Made here only
+        when a run needs it; `release` removes it.
+        """
+        made = getattr(self, "_scratch_dir", None)
+        if made is None:
+            import tempfile
+
+            made = Path(tempfile.mkdtemp(prefix=f"{self.slug}-"))
+            self._scratch_dir = made
+        return made
+
+    def release(self) -> None:
+        """Remove the scratch directory, if a run made one."""
+        made = getattr(self, "_scratch_dir", None)
+        if made is not None:
+            shutil.rmtree(made, ignore_errors=True)
+            self._scratch_dir = None
+
     def version_argv(self) -> tuple[str, ...]:
         return (self.executable, self.version_flag)
 

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/_analysis.py

@@ -422,6 +422,12 @@ def _run_one(root: Path, adapter: Any, probe: Probe, timeout: int,
                 "concern it covers is reported unexamined."
             ),
         )
+    finally:
+        # Every path, the backstop's included: a scratch dir left behind is
+        # one per run, forever (D235).
+        release = getattr(adapter, "release", None)
+        if release is not None:
+            release()
 
 
 def _cover_one(selected: Selected, root: Path, probe: Probe, timeout: int,

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/_jvm_adapters.py

@@ -14,7 +14,6 @@ from __future__ import annotations
 
 import dataclasses
 import json
-import tempfile
 from collections.abc import Iterable, Sequence
 from pathlib import Path
 from typing import Any
@@ -167,7 +166,6 @@ class CheckstyleAdapter(BaseAdapter):
             findings_exit_codes=tuple(range(254)),
             languages=("java",),
         )
-        self._work = Path(tempfile.mkdtemp(prefix="checkstyle-"))
 
     def has_targets(self, root: Path, excludes: Sequence[str] = ()) -> bool:
         """Whether any .java file survives the exclusions (never spawn empty)."""
@@ -189,7 +187,7 @@ class CheckstyleAdapter(BaseAdapter):
             # resolves its optional checkstyle-suppressions.xml against
             # the working directory, and the audited tree must not be
             # able to suppress its own findings (audit M2).
-            cwd=self._work,
+            cwd=self.scratch(),
         )
 
     def _read(self, result: ToolResult) -> Extraction:
@@ -265,15 +263,19 @@ class SpotBugsAdapter(BaseAdapter):
         # default detectors include the SECURITY category. A bundled
         # exclude filter — written to this adapter's own scratch dir,
         # never read from the audited tree — keeps that boundary real
-        # instead of documentation (48293d3 audit M1).
-        self._work = Path(tempfile.mkdtemp(prefix="spotbugs-"))
-        self._exclude = self._work / "exclude-security.xml"
-        self._exclude.write_text(
-            "<FindBugsFilter>\n"
-            '  <Match><Bug category="SECURITY"/></Match>\n'
-            "</FindBugsFilter>\n",
-            encoding="utf-8",
-        )
+        # instead of documentation (48293d3 audit M1). Written when a run
+        # needs it, into a scratch dir removed after the run (D235).
+
+    def _exclude_filter(self) -> Path:
+        path = self.scratch() / "exclude-security.xml"
+        if not path.exists():
+            path.write_text(
+                "<FindBugsFilter>\n"
+                '  <Match><Bug category="SECURITY"/></Match>\n'
+                "</FindBugsFilter>\n",
+                encoding="utf-8",
+            )
+        return path
 
     def version_argv(self) -> tuple[str, ...]:
         return ("spotbugs", "-version")
@@ -347,7 +349,7 @@ class SpotBugsAdapter(BaseAdapter):
         dirs = self._target_dirs(root, class_dirs)
         return Invocation(
             argv=("spotbugs", "-textui", "-exitcode", "-xml:withMessages",
-                  "-exclude", str(self._exclude),
+                  "-exclude", str(self._exclude_filter()),
                   *(str(directory) for directory in dirs)),
             findings_exit_codes=self.findings_exit_codes,
         )

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/_metric_adapters.py

@@ -14,7 +14,6 @@ import csv
 import io
 import json
 import re
-import tempfile
 from collections.abc import Iterable, Sequence
 from pathlib import Path
 
@@ -196,7 +195,6 @@ class ComplexipyAdapter(BaseAdapter):
             slug="complexipy", emits="metric", executable="complexipy",
             concepts=("cognitive_complexity",), findings_exit_codes=(0, 1),
         )
-        self._work = Path(tempfile.mkdtemp(prefix="complexipy-"))
 
     def target_files(self, root: Path, excludes: Sequence[str] = ()) -> tuple[str, ...]:
         return expand_files(root.resolve(), excludes)
@@ -212,11 +210,11 @@ class ComplexipyAdapter(BaseAdapter):
         return Invocation(
             argv=(self.executable, *targets, "--output-format", "json", "--quiet"),
             findings_exit_codes=self.findings_exit_codes,
-            cwd=self._work,
+            cwd=self.scratch(),
         )
 
     def _read(self, result: ToolResult) -> Extraction:
-        report = self._work / "complexipy-results.json"
+        report = self.scratch() / "complexipy-results.json"
         if not report.exists():
             raise ValueError("complexipy wrote no results file")
         entries = json.loads(report.read_text(encoding="utf-8"))

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/_ratio_adapters.py

@@ -20,7 +20,6 @@ for analyzability and testability. Two kinds of number, two modules.
 from __future__ import annotations
 
 import json
-import tempfile
 from collections.abc import Iterable, Sequence
 from pathlib import Path
 
@@ -64,8 +63,8 @@ class JscpdAdapter(BaseAdapter):
         # picks the destination when it builds the invocation and reads it
         # back when parsing. A scratch directory rather than the scanned
         # tree: writing into the repository under audit would change what
-        # the next tool sees.
-        self._report_dir = Path(tempfile.mkdtemp(prefix="jscpd-"))
+        # the next tool sees. Made on first use and removed after the
+        # run (`BaseAdapter.scratch`, D235).
 
     def version_argv(self) -> tuple[str, ...]:
         return _npx("jscpd", "--version")
@@ -91,11 +90,11 @@ class JscpdAdapter(BaseAdapter):
         ignore = ("--ignore", ",".join(patterns)) if patterns else ()
         return Invocation(
             argv=(*_npx("jscpd"), str(root), "--reporters", "json", "--silent",
-                  *ignore, "--output", str(self._report_dir)),
+                  *ignore, "--output", str(self.scratch())),
         )
 
     def _read(self, result: ToolResult) -> Extraction:
-        report = self._report_dir / "jscpd-report.json"
+        report = self.scratch() / "jscpd-report.json"
         raw = report.read_text(encoding="utf-8") if report.exists() else result.stdout
         if not raw.strip():
             # No report file and no stdout is "ran, produced nothing",

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/src/maintainability_audit/cli.py

@@ -43,7 +43,7 @@ from .config import (
     load_config,
     repository_path,
 )
-from .git_tools import changed_paths
+from .git_tools import GitCommandFailed, changed_paths
 from .instructions import (
     INSTRUCTION_TARGETS,
     UnknownTarget,
@@ -492,7 +492,14 @@ def main(argv: list[str] | None = None) -> int:
         return 0
 
     selection = _selection_from(parser, args.work)
-    only_paths = changed_paths(root, args.changed_only) if args.changed_only else None
+    try:
+        only_paths = changed_paths(root, args.changed_only) if args.changed_only else None
+    except GitCommandFailed as unresolved:
+        # A range git cannot resolve is a bad input, said so by name, not a
+        # traceback a pipeline cannot tell from a broken tool (D234).
+        print(f"maintainability-agent: --changed-only {args.changed_only} cannot be "
+              f"resolved ({unresolved})", file=sys.stderr)
+        return 2
     external_findings = read_sarif_inputs(args.sarif_input)
     report = build_report(root, config, only_paths=only_paths,
                           changed_revspec=args.changed_only,

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/tests/test_analyzer_primary_estimate.py

@@ -31,8 +31,6 @@ calibration constant against the new path is 3.6.
 from __future__ import annotations
 
 import subprocess
-import tempfile
-from pathlib import Path
 
 import pytest
 
@@ -44,9 +42,9 @@ from maintainability_audit.scoring import score_evidence
 
 
 @pytest.fixture
-def evidence():
+def evidence(tmp_path):
     """A committed tree of ordinary small functions, scored cleanly."""
-    root = Path(tempfile.mkdtemp()) / "r"
+    root = tmp_path / "r"
     root.mkdir()
     subprocess.run(["git", "init", "-q", str(root)], check=True)
     (root / "README.md").write_text("# r\n", encoding="utf-8")

maintainability_agent-4.4.6/tests/test_analyzers_leave_no_temp_dirs.py

@@ -0,0 +1,88 @@
+"""An analyzer leaves nothing behind in the system temp directory (D235).
+
+Four adapters — jscpd, complexipy, checkstyle, spotbugs — made a scratch
+directory with `tempfile.mkdtemp` in their constructors and never removed
+it. Every adapter object built left a directory, whether or not its tool
+ever ran: the registry is built on every audit and many times in every
+test run, so one machine's temp directory held 74,535 of them (21,294
+`jscpd-`, 20,185 `complexipy-`, 16,952 `checkstyle-`, 16,104 `spotbugs-`)
+on a disk at 98%, and removing them freed 13.5 GB.
+
+A scratch directory is now made only when a tool is about to run, and is
+removed once its output has been read, whatever the outcome.
+"""
+
+from __future__ import annotations
+
+import tempfile
+from pathlib import Path
+from types import SimpleNamespace
+
+import pytest
+
+from maintainability_audit import _analysis
+from maintainability_audit._generic import DECLARED, declared_adapter
+from maintainability_audit._runner import Outcome, ToolResult
+from maintainability_audit._tool_adapters import ADAPTERS
+
+SCRATCH_ADAPTERS = ("jscpd", "complexipy", "checkstyle", "spotbugs")
+
+
+@pytest.fixture
+def temp_root(tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> Path:
+    """The system temp directory, redirected to one this test can count."""
+    root = tmp_path / "system-temp"
+    root.mkdir()
+    monkeypatch.setattr(tempfile, "tempdir", str(root))
+    return root
+
+
+def test_building_every_adapter_makes_no_directory(temp_root: Path) -> None:
+    adapters = [make() for make in ADAPTERS.values()] + [declared_adapter(slug) for slug in DECLARED]
+
+    assert len(adapters) > 10
+    assert list(temp_root.iterdir()) == []
+
+
+@pytest.mark.parametrize("slug", SCRATCH_ADAPTERS)
+def test_a_run_removes_its_scratch_directory_whatever_the_outcome(
+        slug: str, temp_root: Path, tmp_path: Path, monkeypatch: pytest.MonkeyPatch) -> None:
+    tree = tmp_path / "tree"
+    tree.mkdir()
+    (tree / "A.java").write_text("class A {}\n", encoding="utf-8")
+    (tree / "a.py").write_text("x = 1\n", encoding="utf-8")
+    (tree / "build" / "classes").mkdir(parents=True)
+    (tree / "build" / "classes" / "A.class").write_bytes(b"\xca\xfe\xba\xbe")
+    monkeypatch.setattr(_analysis, "run", lambda tool, invocation, **k: ToolResult(
+        slug=tool, outcome=Outcome.RAN, stdout="", stderr="", exit_code=0))
+    probe = SimpleNamespace(check=lambda tool, argv: SimpleNamespace(
+        usable=True, version="1", outcome=Outcome.RAN, detail=""))
+
+    _analysis._run_one(tree, ADAPTERS[slug](), probe, 60, _analysis.Analysis())
+
+    assert list(temp_root.iterdir()) == []
+
+
+def test_no_test_makes_a_temp_directory_it_never_removes() -> None:
+    """The suite's own share of the same leak: `mkdtemp` is never cleaned up.
+
+    `tmp_path` is pytest's and is pruned; `TemporaryDirectory` removes
+    itself. A bare `mkdtemp` in a test leaves one directory per run.
+    """
+    tests = Path(__file__).resolve().parent
+    offenders = sorted(
+        path.name for path in tests.glob("*.py")
+        if path.name != Path(__file__).name and "mkdtemp(" in path.read_text(encoding="utf-8")
+    )
+    assert offenders == [], f"these tests leave a temp directory behind: {offenders}"
+
+
+def test_every_test_writes_its_temp_files_under_pytests_own_base(
+        tmp_path: Path, tmp_path_factory: pytest.TempPathFactory) -> None:
+    """A test that builds an adapter and calls it piecemeal never reaches the
+    release in `_run_one`; the suite left 29 directories that way after the
+    adapters were fixed. So no test can write to the system temp directory —
+    and not into `tmp_path` either, which is often the tree under audit."""
+    temp = Path(tempfile.gettempdir()).resolve()
+    assert temp.is_relative_to(tmp_path_factory.getbasetemp().resolve())
+    assert not temp.is_relative_to(tmp_path.resolve())

{maintainability_agent-4.4.4 → maintainability_agent-4.4.6}/tests/test_artifact_write_route_class.py

@@ -93,10 +93,16 @@ def test_no_artifact_writer_reaches_for_a_raw_write_text() -> None:
     )
 
 
-def _inward_symlink_repo() -> Path:
+@pytest.fixture
+def inward_repo():
     """A repo under ``/var`` (unresolved on macOS) whose ``.maintainability``
-    is a symlink back into ``src`` -- the redirect ``tmp_path`` cannot make."""
-    base = Path(tempfile.mkdtemp(dir="/var/tmp"))
+    is a symlink back into ``src`` -- the redirect ``tmp_path`` cannot make.
+    Removed afterwards; a bare ``mkdtemp`` left one per run (D235)."""
+    with tempfile.TemporaryDirectory(dir="/var/tmp") as base:
+        yield _inward_symlink_repo(Path(base))
+
+
+def _inward_symlink_repo(base: Path) -> Path:
     root = base / "repo"
     (root / "src").mkdir(parents=True)
     (root / "src" / "app.py").write_text("x = 1\n", encoding="utf-8")
@@ -109,12 +115,12 @@ def _report(root: Path) -> dict:
 
 
 @pytest.mark.parametrize("spelling", ["/var", "/private/var"])
-def test_write_baseline_refuses_the_inward_route_on_either_spelling(spelling: str) -> None:
+def test_write_baseline_refuses_the_inward_route_on_either_spelling(spelling: str, inward_repo: Path) -> None:
     """``.maintainability -> src`` is refused whether the grant is named
     ``/var/...`` or its ``/private/var/...`` real path. Binding the check
     to ``target.parent`` checked the symlink against itself and let both
     through."""
-    root = _inward_symlink_repo()
+    root = inward_repo
     if spelling == "/private/var":
         root = Path(os.path.realpath(root))
     target = root / ".maintainability" / "baseline.json"
@@ -125,11 +131,11 @@ def test_write_baseline_refuses_the_inward_route_on_either_spelling(spelling: st
     assert not (Path(os.path.realpath(root)) / "src" / "baseline.json").exists()
 
 
-def test_write_baseline_refuses_to_truncate_a_non_json_file() -> None:
+def test_write_baseline_refuses_to_truncate_a_non_json_file(inward_repo: Path) -> None:
     """``write_baseline(baseline_path="README.md")`` truncated source once
     (D34). A stage-and-replace still unlinks that inode, so the refusal is
     on the existing bytes not being JSON, before any stage begins."""
-    root = _inward_symlink_repo()
+    root = inward_repo
     readme = root / "README.md"
     readme.write_text("# real docs\n", encoding="utf-8")
     report = _report(root)
@@ -138,11 +144,11 @@ def test_write_baseline_refuses_to_truncate_a_non_json_file() -> None:
     assert readme.read_text(encoding="utf-8") == "# real docs\n"
 
 
-def test_a_baseline_outside_the_tree_is_still_allowed() -> None:
+def test_a_baseline_outside_the_tree_is_still_allowed(inward_repo: Path) -> None:
     """The predating contract: a person may keep a baseline outside the
     audited tree. Outside the grant the tree cannot plant a route, so the
     write proceeds -- the refusals above do not become a new bound."""
-    root = _inward_symlink_repo()
+    root = inward_repo
     outside = root.parent / "backups" / "baseline.json"
     write_baseline(str(outside), _report(root))
     assert json.loads(outside.read_text(encoding="utf-8"))["version"] == 3